Is this just another way to locate him as if it's really serious, only his private key can be used to decrypt it, and his former employer have the public key they use to exchange crypted messages before. In this case it's really stupid
An encrypted message to Edward Snowden
131–140 of 164 posts
Re: An encrypted message to Edward Snowden
#132Earlier quoted context omitted.
Not safe at all. Timing analysis can detect correlations between data arriving at the interviewers computer with data sent by the suspect's computer. Encryption is good at keeping the contents secret, but not the source of traffic.
Snowden isn't "in hiding" from intelligence agencies, only from the news media. I assess with virtually nil probability that US and Chinese/HK intelligence don't know where he is right now (the only way one intelligence service wouldn't know details is if the other has already taken him into protection or custody). He doesn't need to use anonymity systems now; he just needs to use a service which doesn't report IP ad…
Another anonymous form of communication he could use that would he an lot simpler and hard to track would be old fashioned mail. No need to use a sledgehammer and all that.
Re: An encrypted message to Edward Snowden
#133Earlier quoted context omitted.
That's not safe at all, considering the organization tracking him.
When using Bitmessage, everybody receives all the messages in the blockchain. How is the timing attack going to identify him? Maybe Bitmessage helps receiving messages anonymously, but the timing attack might still be possible when sending messages. I2P can mitigate the problem, but I don't think Bitmessage has any nodes in I2P. I would say that, if you don't trust Poulsen, don't talk to him.
When user receives message, delivery confirmation is sent back.
Re: An encrypted message to Edward Snowden
#134Earlier quoted context omitted.
Snowden called himself Verax[1]. Anyone who wants to send a message to Snowden* can just: $ gpg --keyserver pgp.mit.edu --recv-keys 79DEBE35 $ gpg --encrypt --sign --armor --recipient 79DEBE35 and post it publicly; perhaps on Pastebin. [1]: http://www.washingtonpost.com/world/national-security/code-n... *assuming you believe the key is authentic
79DEBE35 is a key in the possession of Wired, I'm sure they'll enjoy passing your message on the the NSA via their parent media giant. Edit: Also, it's not very hard to generate a different key with signature 79DEBE35, and put it on the key servers. gpg's displaying of such short abbreviations for keys is one the worst parts of its UI.
You can naturally use longer fingerprint to confirm keys.
pub 1024D/274EF626 2006-07-25 [expires: 2046-07-15]
Key fingerprint = 166C 5F6B 8808 A9BE B2B4 F265 AE02 7784 274E F626
Re: An encrypted message to Edward Snowden
#135Snowden, just remember that Kevin Poulsen and Adrian Lamo helped the US Government in catching Bradley Manning. EDIT: Also, a pretty safe way to carry an interview would be VPN + Tor + Bitmessage. EDIT2: Users sneak and tlb claim Tor isn't safe because of timing attacks. Read below.
A couple of days ago I read that 'As of 2012, 80% of the Tor Project's $2M annual budget comes from the United States government.' http://online.wsj.com/article/SB1000142412788732467720457818... That might be another reason that TOR isn't safe. You don't ever know who any of the other servers belong to ... and the staff at the Exit Node can (and has) read anything. I wouldn't bet my life on software 'originally spons…
So that they could conduct cyberwarfare ops and maintain deniability. Math is math. All of the cards are on the table, the code is entirely open. The protocol is designed in such a way that any of the in-transit nodes know fuckall about the messages source, destination, or content. There is no "the" exit node, anyone can operate one. Not to mention that there is nothing stopping you from encrypting the data going into the network in the first place. And If you think for a second that the military has some magical insight into information-theory that allowed them to hide a backdoor in a god damn protocol spec, then shit, they can probably factor large primes too, in which case modern crypto is broken.
Re: An encrypted message to Edward Snowden
#136My guess is that this message is Wired asking Snowden for a chat so that they can get some kind of exclusive story. However, as others have pointed out, Wired magazine doesn't exactly have a good reputation when it comes to defending whistle blowers.
Re: An encrypted message to Edward Snowden
#137Earlier quoted context omitted.
In a world where the US government is scanning all your electronic communications, and (we'll next discover) searching your OS X- and Windows-based computers at will, how do you, as a practical matter, keep your private key "private"?
If you want a realistic chance of not losing control of your private key the only real answers are hardware based - using a tamper resistant smart card, hardware security module, tpm or similar systems in which the signing is done inside the chip that contains your signing keys and no general purpose device ever sees the key at all. Most people using software only solutions won't ever have their keys stolen, but that…
I may be on the edge but a "Trusted Platform Module" doesnt automatically let me conclude that indeed the hardware module is to be trusted.
It seems quite unlikely the masses would have access to a trusted platform of any kind, especially considering that any secure platforms for communication that have existed, like Skype, have been opened up. Even good old GSM (AS/1 was it called?) voice-talk encryption was designed with a backdoor in mind at the urging of NATO.
Re: An encrypted message to Edward Snowden
#138Earlier quoted context omitted.
A couple of days ago I read that 'As of 2012, 80% of the Tor Project's $2M annual budget comes from the United States government.' http://online.wsj.com/article/SB1000142412788732467720457818... That might be another reason that TOR isn't safe. You don't ever know who any of the other servers belong to ... and the staff at the Exit Node can (and has) read anything. I wouldn't bet my life on software 'originally spons…
So that they could conduct cyberwarfare ops and maintain deniability. Math is math. All of the cards are on the table, the code is entirely open. The protocol is designed in such a way that any of the in-transit nodes know fuckall about the messages source, destination, or content. There is no "the" exit node, anyone can operate one. Not to mention that there is nothing stopping you from encrypting the data going int…
>There is no "the" exit node, anyone can operate one.
From what I understand an awful lot of them are run by the US government.
Re: An encrypted message to Edward Snowden
#139So at a guess basically they've encrypted a message that is not Snowden's key that somehow calls back when decrypted (link, exe or something) so they know if the NSA is listening in.
That would be damn interesting if during decryption it could exploit the decryptor software, PGP, and ping a server or two.
Is that possible? To epxloit a decryptor software while it is decrypting something.
Re: An encrypted message to Edward Snowden
#140If Edward Snowden does have a pgp key (I can't find one online), it hasn't been revealed in this message. It looks like the signing and encryption keys are the same: gpg: armor: BEGIN PGP MESSAGE gpg: armor header: Version: GnuPG/MacGPG2 v2.0.19 (Darwin) gpg: armor header: Comment: GPGTools - http://gpgtools.org :pubkey enc packet: version 3, algo 1, keyid 5B50940B79DEBE35 data: [4096 bits] gpg: public key is 79DEBE3…
Steganography.